UU PDP-ready for your AI app.
UU PDP (UU 27/2022) is now in full effect, with penalties of up to 2% of annual revenue. Anoman is built to help with your AI app's UU PDP readiness: a Jakarta-hosted gateway, PII masked before the LLM, and every request leaves an audit trail.
Why data residency matters now
When your app calls an LLM API directly, user prompts — along with the personal data inside them — are sent and often processed on overseas servers. With UU PDP now in full effect, the question “where is our users' data?” is no longer a technical question but one your legal team must be able to answer. Anoman gives a simple answer: data stored in Jakarta, and personal data masked before the request is forwarded to the model.
Stored in Jakarta
Traces and usage logs are stored in a Jakarta data center; prompt and response content is stored only if you turn on content capture (off by default).
PII masking before the LLM
NIK (KTP), email, and credit cards are detected and masked in every request — before the data reaches any LLM provider. Phone, IP, and URL detection are available as opt-in.
Audit trail on every request
Every call is logged: which model, which guardrails were active, which entities were masked. Logs can be exported — technical evidence for when your legal team or an auditor asks.
Guardrails in the request path
Prompt injection detection and content moderation (Indonesian + English) run in the same pipeline — layered protection, not just a proxy.
How it works
Change the base URL
Point your OpenAI SDK to https://api.anoman.io/v1 — no other code changes.
Guardrails run automatically
PII masking, injection detection, and content moderation check every request before it reaches the provider.
The trail is stored in Jakarta
Traces, logs, and usage data are stored in Indonesia — ready to export for audit needs.
Transparent in every response
Not a promise on a marketing page — every API response carries headers that show the processing region and the result of each guardrail.
curl https://api.anoman.io/v1/chat/completions \
-H "Authorization: Bearer anm-sk-..." \
-d '{
"model": "gpt-4o-mini",
"messages": [{"role": "user", "content": "Summarize this contract document..."}]
}'# Every response carries transparency headers:
X-Anoman-Region: ID
X-Anoman-Guardrail-Pii: masked 3 entities (1 ID_NIK, 1 EMAIL_ADDRESS, 1 CREDIT_CARD)
X-Anoman-Guardrail-Injection: pass score=0.02
# Traces are stored in Jakarta; X-Anoman-Region names where the model ran.Note: Anoman is built to help with UU PDP readiness — the Jakarta-hosted gateway and data storage, PII masking, and audit trail are its technical foundation. Your organization's full compliance still depends on your own internal policies and processes. Start free with a daily guarded allowance plus a premium-model trial credit — see the pricing page. Related: Indonesian-language chatbot with guardrails and data residency details.
Frequently asked questions
Does Anoman make my app UU PDP-compliant?
Anoman is built to help with UU PDP readiness — a Jakarta-hosted gateway and data storage, PII masking, and audit trails are its technical foundation. Your organization's full compliance still depends on your own internal policies and processes, such as the legal basis for processing, user consent, and data governance.
Where is my data stored?
Traces and usage logs are stored in a Jakarta data center; prompt and response content is stored only if you turn on content capture (off by default). The X-Anoman-Region header on every response shows where the model processed it.
Are my prompts sent overseas?
Honestly: LLM providers (such as OpenAI, Anthropic, or Google) may process requests on overseas servers. That's why Anoman masks personal data (NIK, email, credit card; phone/IP/URL on request) before the request is forwarded to the provider, offers an opt-in per-key data-residency lock that refuses any model processed outside your allowed regions, and stores the entire trail in Jakarta.